Goodbye to alert chaos: Flexible deduplication and correlation with IOMETRICS^® Alerta

In this article, we’ll explore how IOMETRICS^® Alerta takes infrastructure monitoring to the next level. Built on top of Alerta.io, this centralised event manager goes beyond the limitations of the original model by adding capabilities such as flexible deduplication, asynchronous plugin execution, and automated remediation. Discover how its new architecture helps you take control of high alert volumes more efficiently, enrich their context, and significantly reduce the need for manual intervention.

What does Alerta.io provide out of the box?

Alerta.io is a monitoring system designed to consolidate and deduplicate alerts from multiple sources (Zabbix, Prometheus, Elastic, Grafana, etc.), providing a unified view of infrastructure health. Its alert model is flexible: it defines standard fields, but allows extensions through custom attributes and tags, making it easy to adapt to heterogeneous source formats via webhooks.

The system is modular: it supports different database backends (PostgreSQL, MongoDB), provides a central REST API, a Vue.js-based web UI, basic asynchronous task handling using Celery + Redis to execute operations over large alert sets, and a Python CLI to manage alerts from the command line.

Advanced handling is achieved via plugins that run at different points in the alert lifecycle (pre-receive, post-receive, status changes, manual actions, notes, and deletion), enabling enrichment, filtering, or notification of each event with custom logic.

The real power comes from combining three components: the flexible alert model, plugins, and the routing module that decides which plugins to execute on each state transition. In the original design, plugin execution is synchronous and sequential: an alert is not fully processed until all plugins have finished, which limits throughput at scale when integrations are slow (for example, creating Jira tickets or sending events to external platforms).

IOMETRICS^® Alerta: a functional layer on top of Alerta.io

IOMETRICS^® Alerta uses Alerta.io as its foundation for deduplication, basic correlation, and a flexible model, and adds a set of Python modules that extend its behaviour without modifying the original project’s code. This makes it possible to cover advanced use cases that the upstream project either does not solve or only solves in a limited way.

The platform introduces a dedicated PostgreSQL backend (iometrics) that enables more flexible deduplication and access to additional tables, as well as a routing module that extracts the list of plugins to execute from the alerters attribute of each alert. Alongside this routing, modules for recovery, blackouts, contextualisation, notification, and correlation are orchestrated, resulting in an event-processing pipeline that is fully configurable via plugins.

In addition, IOMETRICS^® Alerta provides extra APIs to, for example, process alerts asynchronously end-to-end, query the status of the “alerters” associated with a given alert, and manage alert contextualisation rules.

Key functionality added by IOMETRICS^® Alerta

Flexible deduplication and correlations

Alerta.io’s original deduplication is based on the resource/event pair. This works well for some sources, but falls short in more complex scenarios. IOMETRICS^® Alerta adds the option to deduplicate by attribute: if two alerts share the same value in the deduplication attribute and one is active, the new one will be treated as a duplicate of the first regardless of resource or event.

The ability to use the original mechanism, the new one, or both is preserved, allowing you to evolve the model without breaking existing integrations. In addition, the inferredCorrelation attribute is introduced: if an alert arrives with this field populated with one or more IDs of open alerts, the system correlates them and can deduplicate against the alert with the best score.

The logic that populates inferredCorrelation is delegated to correlation providers. These run when an alert arrives and calculate the correlation percentage against other open alerts. Available correlation providers include time-based correlation (the closer in time, the higher the likelihood), topology-based correlation (leveraging IOMetrics Skydive, measuring the “distance” between nodes in the topology), and text-based correlation (sentences-correlator, using ML techniques to evaluate similarity between event descriptions).

Asynchronous and scalable alerting

One of the clearest differentiators between IOMETRICS^® Alerta and the original Alerta.io is notification handling. In the base design, plugins run synchronously and sequentially, meaning any slow integration (for example, creating Jira issues, which can take several seconds) reduces overall throughput.

IOMETRICS^® Alerta introduces a specific plugin type that runs asynchronously using Celery and Redis. Asynchronous alerting plugins implement an Alerter interface with methods invoked when an alert is created, repeated, or closed, which fully decouples alert ingestion from the execution of notification actions.

Recovery and remediation actions

IOMETRICS^® Alerta adds an explicit mechanism to execute recovery or automated remediation actions before sending notifications to third parties. These actions are integrated via recovery providers, exposed as plugins that run when an alert is received and attempt to resolve the incident without human intervention.

While recovery is in progress, alerting plugins are not executed; only if recovery fails are the configured notifications triggered (email, Jira, Odoo, Slack, Teams, etc.).

Advanced blackout management

Blackout window handling is another area that is strengthened. Alerta.io allows blackouts to be defined via its API and UI, storing them in the database and preventing notifications during those periods for affected resources.

IOMETRICS^® Alerta introduces an extensible blackout provider mechanism, enabling external sources to be integrated to decide whether an alert is in blackout.

When an alert is in blackout, alerting plugins are not executed and no notifications are generated; however, the system still tracks the end of the blackout. If the alert remains active when the blackout period ends, the corresponding notification plugins are then executed.

Alert contextualisation and enrichment

Another key component of IOMETRICS^® Alerta is its contextualisation engine, which enriches alerts with additional information in a declarative way. The system provides an API to define contextualisation rules with two parts: a condition (expressed using alert fields and attributes) and a context (information that will be added to or modified in the alert if the condition is met).

These rules are executed upon receiving the alert and allow, for example, adding service information, criticality, responsible party, or useful links, without needing to modify the original monitoring source.

Asynchronous alert creation API

Beyond Alerta.io’s standard webhooks, IOMETRICS^® Alerta exposes an alert-creation API that runs the entire alert processing pipeline asynchronously end-to-end. The client receives a task identifier that can be queried to track processing status and, once completed, retrieve the generated alert associated with that task.

This approach fits better with integrations that do not require an immediate response but do want guarantees of full processing and traceability—particularly useful when expensive steps are involved, such as advanced correlation, complex contextualisation, or automated remediation.

In summary…

IOMETRICS^® Alerta positions itself as a significant evolution of Alerta.io, extending its capabilities through a more flexible, scalable architecture geared towards intelligent automation.

Thanks to improvements in deduplication, advanced correlation, contextualisation, blackout handling, and asynchronous plugin execution, the platform enables high-volume alert management more efficiently and with less reliance on manual intervention.

Its modular, extensible approach makes it easy to integrate automated recovery, decoupled notifications, and declarative rules—delivering a more robust, configurable event-processing pipeline aligned with modern operations environments.

References:

io: https://alerta.io
Alerta.io code repository: https://github.com/alerta
Código de IOMETRICS^® Alerta: https://github.com/datadope-io/datadope-alerta

Victor García

Goodbye to alert chaos: Flexible deduplication and correlation with IOMETRICS^® Alerta

What does Alerta.io provide out of the box?

IOMETRICS^® Alerta: a functional layer on top of Alerta.io